CVE-2021-27142

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

Hardcoded credentials

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

CVE-2021-27142

The CVE-2021-27142 entry concerns FiberHome HG6245D devices (RP2613). The issue is that the web management interface runs over HTTPS but uses a hardcoded private key with permissions 0777, exposed in the device’s web stack. This configuration enables potential disclosure or misuse of the private ...

CVE-2021-27142

An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions...

CVE-2020-24838

An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow...

Integer overflow

An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow...

CVE-2020-24838

An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow...

CVE-2020-24838

CVE-2020-24838 describes an integer overflow in Issuer where the issuedCount can become zero if a parameter is overly large. An attacker could potentially obtain the private key of the owner issued with a certain amount, with the overflow allowing issuedCount to reach zero. The Red Hat entry mirr...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

Design/Logic Flaw

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2021-26905

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key...

CVE-2021-26905

CVE-2021-26905: Affects 1Password SCIM Bridge prior to 1.6.2. The component mishandles validation of authenticated requests for log files, allowing exposure of the TLS private key. Remediation: upgrade to 1.6.2 or later. No exploitation details are provided in the sources; vulnerability context i...

Information Disclosure

elliptic is vulnerable to information disclosure. Usage of an insecure secp256k1 implementation in elliptic/ec/key.js can cause the disclosure of the private key after a number of ECDH operations are performed...

HashiCorp Vault Enterprise Unauthorized Access Vulnerability

HashiCorp Vault is a private key access management tool from HashiCorp USA. An unauthorized access vulnerability exists in HashiCorp Vault Enterprise versions 1.6.0 and 1.6.1 that allows execution of the remove-peer raft operator command on the disaster recovery side without authentication. No...

CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

DEBIAN-CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

UBUNTU-CVE-2020-28498

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the...

CVE-2020-28498

CVE-2020-28498 affects the elliptic JS library (Node.js elliptic module) specifically the secp256k1 implementation in elliptic/ec/key.js. The root cause is that there is no validation to ensure the public key point passed to derive() actually lies on the secp256k1 curve, enabling potential privat...